Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0150 advisory.

  - acroread: multiple code execution flaws (APSB13-02) (CVE-2012-1530, CVE-2013-0601, CVE-2013-0602,     CVE-2013-0603, CVE-2013-0604, CVE-2013-0605, CVE-2013-0606, CVE-2013-0607, CVE-2013-0608, CVE-2013-0609,     CVE-2013-0610, CVE-2013-0611, CVE-2013-0612, CVE-2013-0613, CVE-2013-0614, CVE-2013-0615, CVE-2013-0616,     CVE-2013-0617, CVE-2013-0618, CVE-2013-0619, CVE-2013-0620, CVE-2013-0621, CVE-2013-0623, CVE-2013-0626,     CVE-2013-1376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote Mac OS X host is prior to 11.0.1, 10.1.5, or 9.5.3. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption conditions exist that allow     an attacker to execute arbitrary code or cause a denial     of service. (CVE-2012-1530, CVE-2013-0601,     CVE-2013-0605, CVE-2013-0616, CVE-2013-0619,     CVE-2013-0620, CVE-2013-0623)

  - A use-after-free error exists that allows an attacker to     execute arbitrary code. (CVE-2013-0602)

  - Multiple heap buffer overflow conditions exist that     allow an attacker to execute arbitrary code.
    (CVE-2013-0603, CVE-2013-0604)

  - Multiple stack overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2013-0610,     CVE-2013-0626)

  - Multiple unspecified buffer overflow conditions exist     that allow an attacker to execute arbitrary code.
    (CVE-2013-0606, CVE-2013-0612, CVE-2013-0615,     CVE-2013-0617, CVE-2013-0621, CVE-2013-1376)

  - Multiple integer overflow conditions exist that allow     an attacker to execute arbitrary code. (CVE-2013-0609,     CVE-2013-0613)

  - A privilege escalation vulnerability exists that allows     a local attacker to execute arbitrary code.
    (CVE-2013-0627)

  - Multiple logic errors exist that allow an attacker to     execute arbitrary code. (CVE-2013-0607, CVE-2013-0608,     CVE-2013-0611, CVE-2013-0614, CVE-2013-0618)

  - Multiple security bypass vulnerabilities exist that     allow an attacker to bypass access restrictions.
    (CVE-2013-0622, CVE-2013-0624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote host is earlier than 11.0.1 / 10.1.5 / 9.5.3 and is, therefore, affected by multiple vulnerabilities :

  - Multiple, unspecified memory corruption errors exist.
    (CVE-2012-1530, CVE-2013-0601, CVE-2013-0605,     CVE-2013-0616, CVE-2013-0619, CVE-2013-0620,     CVE-2013-0623)

  - A use-after-free vulnerability exists. (CVE-2013-0602)

  - Multiple heap overflow vulnerabilities exist.     (CVE-2013-0603, CVE-2013-0604)

  - Multiple stack overflow vulnerabilities exist.
    (CVE-2013-0610, CVE-2013-0626)

  - Multiple buffer overflow vulnerabilities exist.
    (CVE-2013-0606, CVE-2013-0612, CVE-2013-0615,     CVE-2013-0617, CVE-2013-0621, CVE-2013-1376)

  - Multiple integer overflow vulnerabilities exist.
    (CVE-2013-0609, CVE-2013-0613)

  - A local privilege escalation vulnerability exists.
    (CVE-2013-0627)

  - Multiple logic error vulnerabilities exist.     (CVE-2013-0607, CVE-2013-0608, CVE-2013-0611,     CVE-2013-0614, CVE-2013-0618)

  - Multiple security bypass vulnerabilities exist.
    (CVE-2013-0622, CVE-2013-0624)

The version of Adobe Acrobat installed on the remote host is earlier than 11.0.1 / 10.1.5 / 9.5.3 and is, therefore, affected by multiple vulnerabilities :

  - Multiple, unspecified memory corruption errors exist.
    (CVE-2012-1530, CVE-2013-0601, CVE-2013-0605,     CVE-2013-0616, CVE-2013-0619, CVE-2013-0620,     CVE-2013-0623)

  - A use-after-free vulnerability exists. (CVE-2013-0602)

  - Multiple heap overflow vulnerabilities exist.     (CVE-2013-0603, CVE-2013-0604)

  - Multiple stack overflow vulnerabilities exist.
    (CVE-2013-0610, CVE-2013-0626)

  - Multiple buffer overflow vulnerabilities exist.
    (CVE-2013-0606, CVE-2013-0612, CVE-2013-0615,     CVE-2013-0617, CVE-2013-0621, CVE-2013-1376)

  - Multiple integer overflow vulnerabilities exist.
    (CVE-2013-0609, CVE-2013-0613)

  - A local privilege escalation vulnerability exists.
    (CVE-2013-0627)

  - Multiple logic error vulnerabilities exist.     (CVE-2013-0607, CVE-2013-0608, CVE-2013-0611,     CVE-2013-0614, CVE-2013-0618)

  - Multiple security bypass vulnerabilities exist.
    (CVE-2013-0622, CVE-2013-0624)

ID	Name	Product	Family	Severity
63466	RHEL 5 / 6 : acroread (RHSA-2013:0150)	Nessus	Red Hat Local Security Checks	high
63455	Adobe Reader < 11.0.1 / 10.1.5 / 9.5.3 Multiple Vulnerabilities (APSB13-02) (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
63454	Adobe Reader < 11.0.1 / 10.1.5 / 9.5.3 Multiple Vulnerabilities (APSB13-02)	Nessus	Windows	critical
63453	Adobe Acrobat < 11.0.1 / 10.1.5 / 9.5.3 Multiple Vulnerabilities (APSB13-02)	Nessus	Windows	critical

Detections

Analytics

CVE-2013-1376

critical

Tenable Plugins

high

critical

critical

critical